Skip to main content
Service Endpoints in Azure let you secure access to PaaS services (for example, Azure Storage) by extending your virtual network’s identity to those services. This keeps traffic between your VNet and the service on the Microsoft backbone and lets you restrict access to only selected VNets or IP ranges. This article explains the concept with a small scenario and walks through enabling Service Endpoints from the Azure portal.

​
Scenario

  • You have a virtual network (VNet) with a subnet and a VM. The VM’s private IP is 192.168.1.4.
  • You have an Azure Storage account (named KodeKloud in the diagram) with public access enabled by default.
  • The VM currently accesses the storage account using the public service endpoint for blobs, which looks like <storage-account>.blob.core.windows.net when used in URLs.

​
Goal

Block all public access to the storage account, but allow the VM (hosted in your VNet/subnet) to continue accessing it securely via a Service Endpoint.

​
How it works (overview)

  • Configure the storage account’s Networking settings to accept requests only from selected virtual networks and IP ranges.
  • Enable a Service Endpoint for the storage service on the subnet that hosts the VM.
  • Once enabled, traffic from the VM to the storage account is routed over the Azure/Microsoft backbone. The storage account sees the VM’s private IP as the source. Although the service endpoint still uses the same public DNS name, traffic does not traverse the public internet.
A network diagram titled "Service Endpoints" showing a Virtual Machine (192.168.1.4) in a VNet/subnet connecting via a Service Endpoint to an Azure Storage Account named KodeKloud. The storage service sees the VM's private IP as the source and direct internet access is blocked (red X).
This configuration improves both security and performance by keeping data transfer on Azure’s private backbone.
Service Endpoints do not give the service a private IP in your subnet; they authorize and route traffic from your subnet to the service over the Azure backbone. If you need a private IP within your VNet for the service itself, consider Azure Private Link as an alternative.

​
Benefits of Azure Service Endpoints

Supported services (examples)

​
Portal demonstration — what we’ll deploy

This walkthrough uses a prep script that creates a VM and a storage account. After the script runs you will have:
  • A VM named VM01 (or similar).
  • A Storage account and a container to test blob access.
Files created by the prep script (example) Example: running the prep script and listing the folder (PowerShell)

​
Create a container and upload files

  • In the Storage account, open “Containers” and create a new container named demo with private (no anonymous) access.
  • Upload a few image files into the demo container so you can test access from both the browser (public) and the VM (private VNet).
Screenshot of the Microsoft Azure portal showing the Containers view for a storage account with a single "$logs" container listed. A "New container" pane is open on the right with the name set to "demo" and anonymous access set to Private.

​
Testing access from the VM (before locking down the storage account)

SSH into the VM and download an uploaded file using wget. This demonstrates initial public-access behavior where the VM resolves the public endpoint and downloads the blob. Example: successful download from the VM

​
Lock down the storage account to selected networks

  1. In the Storage account, go to Networking.
  2. Change “Allow access from” from All networks to Selected virtual networks and IP addresses.
  3. Add your VNet (e.g., VNet01) and the specific subnet (for example, default) to the allowed virtual networks. Adding the VNet/subnet at this step effectively creates the Service Endpoint for the storage service on that subnet.
  4. Click Save.
After saving, Azure shows confirmation that your firewall and virtual network settings were saved.
A screenshot of the Microsoft Azure portal showing the Storage accounts blade with a specific storage account's Networking settings (firewalls, virtual networks and firewall IP ranges). A success notification in the top-right confirms the firewall and virtual network settings were saved.
Before switching to “Selected virtual networks and IP addresses”, ensure your management IP or required VNets/subnets are added to avoid locking yourself out of the storage account from the public internet. Add any admin IP addresses or required VNets first, then save.

​
Testing access from the public internet (after locking down)

  • If you try to open the blob URL from a public network / IP that is not on the allowed list, you will receive an authorization error.
Example: browser (public) access blocked (XML error)

​
Testing access from the VM (after locking down)

  • The VM is inside the allowed VNet/subnet, so it should still be able to download blobs. The request is routed over the Microsoft backbone and the storage service sees the VM’s private IP as the source.
Example: VM can still download (saved as City3-copy.jpg)

​
Handling missing blobs and verifying other files

  • If a blob doesn’t exist you’ll receive a 404 error.
Example: missing blob returns 404
  • If the blob exists, the download succeeds as usual.
Example: successful file download

​
Summary

  • Changing the storage account network settings to Selected virtual networks and IP addresses and adding the VNet/subnet blocks public access from outside your allowed networks.
  • The VM inside the allowed VNet/subnet continues to access the storage account; traffic flows over Azure’s backbone and the storage service sees the VM’s private IP as the source.
  • Use Service Endpoints when you want to authorize specific VNets/subnets for access to PaaS services without assigning a private IP for the service inside your VNet.

​
Next steps / Alternatives

  • Azure Private Link provides a different model: it creates a private endpoint (private IP) for the service inside your VNet. Use Private Link when you need the PaaS service to have a private IP on your network or need more granular network isolation.

Watch Video